{"id":"CVE-2026-17405","kind":"vulnerability","aliases":["CVE-2026-17405"],"related":[],"title":"IBM API Connect: broken access checks expose keystore information to users","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not check whether a logged-in user may read keystore objects. A remote authenticated attacker can therefore read keystore information they should not see.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13","12.1.1.3"],"affected":">= 10.0.8.0, <= 10.0.8.12; >= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["auth-required","version-outside-range"],"how_to_check":"Check your API Connect version: 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2 is affected. Fixed: 10.0.8.13, 12.1.1.3. Any account that can sign in to the API Connect management interface/API can reach it.","fix":"Upgrade to API Connect 10.0.8.13 (IBM bulletin) or 12.1.1.3 (per CVE record vendor solution; 12.1.1.3 bulletin text read was truncated). No workaround stated.","status":"open","published_at":"2026-11-07T05:18:57+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","triaged_at":"2026-11-07T05:48:46+00:00","updated_at":"2026-11-07T06:05:36+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-07T05:48:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: broken access checks expose keystore information to users","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not check whether a logged-in user may read keystore objects. A remote authenticated attacker can therefore read keystore information they should not see.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"keystore information readable by any authenticated user","analyst_note":"Check the IBM security bulletin for this CVE for the fixed versions and any interim fix; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges `10.0.8.0` to `10.0.8.12` and `12.1.0.0` to `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams that run IBM API Connect in the affected version ranges and let authenticated users reach keystore objects are exposed. Installations outside the listed ranges, or where no users have accounts, are less likely to be affected. The sources do not say which deployment settings matter beyond this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":4264,"output_tokens":548,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE for the fixed versions and any interim fix; the NVD entry alone gives no fix.","search":"'-17405':14A,17A '-2026':13A,16A '10.0.8.0':39B,75C '10.0.8.12':41B,77C '12.1.0.0':43B,79C '12.1.1.2':45B,81C 'access':5A,99C 'allow':83C 'api':2A,19A,22B,29B,36B,73C 'api-gateway':21B 'attack':62B,87C 'auth':25B 'auth-requir':24B 'authent':61B,86C 'author':98C 'broken':4A,94C 'check':6A,48B,100C 'confirm':106C 'connect':3A,20A,30B,37B,74C 'could':82C,117C 'cve':12A,15A 'due':92C 'expos':7A,118C 'gateway':23B 'host':34B 'ibm':1A,18A,28B,35B,72C 'ibm-api-connect':27B 'inform':9A,67B,91C,120C 'infrastructur':31B 'keystor':8A,57B,66B,102C,119C 'level':97C 'log':52B 'logged-in':51B 'may':55B 'object':58B,96C,103C 'object-level':95C 'obtain':89C 'permit':112C 'read':56B,65B,114C 'remot':60B,85C 'request':109C 'requir':26B 'see':71B 'self':33B 'self-host':32B 'sensit':90C 'therefor':64B 'user':11A,54B,110C 'version':38B 'whether':49B","nicknames":[],"mitigations":[],"who_affected":"Self-managed IBM API Connect deployments on 10.0.8.0 to 10.0.8.12 or 12.1.0.0 to 12.1.1.2. An attacker needs a valid login; the keystore access check does not confirm the user may read the keystore object, so keystore information can be exposed. Teams not running API Connect can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:05:36Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295637","run_id":2005}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","ibmapiconnect"],"ptokens":["api","connect","ibm"],"labels":["apigateway","authrequired","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17405':14A,17A '-2026':13A,16A 'access':5A 'api':2A,19A 'broken':4A 'check':6A 'connect':3A,20A 'cve':12A,15A 'expos':7A 'ibm':1A,18A 'inform':9A 'keystor':8A 'user':11A","search_b":"'10.0.8.0':39B '10.0.8.12':41B '12.1.0.0':43B '12.1.1.2':45B 'api':22B,29B,36B 'api-gateway':21B 'attack':62B 'auth':25B 'auth-requir':24B 'authent':61B 'check':48B 'connect':30B,37B 'gateway':23B 'host':34B 'ibm':28B,35B 'ibm-api-connect':27B 'inform':67B 'infrastructur':31B 'keystor':57B,66B 'log':52B 'logged-in':51B 'may':55B 'object':58B 'read':56B,65B 'remot':60B 'requir':26B 'see':71B 'self':33B 'self-host':32B 'therefor':64B 'user':54B 'version':38B 'whether':49B","search_c":"'10.0.8.0':75C '10.0.8.12':77C '12.1.0.0':79C '12.1.1.2':81C 'access':99C 'allow':83C 'api':73C 'attack':87C 'authent':86C 'author':98C 'broken':94C 'check':100C 'confirm':106C 'connect':74C 'could':82C,117C 'due':92C 'expos':118C 'ibm':72C 'inform':91C,120C 'keystor':102C,119C 'level':97C 'object':96C,103C 'object-level':95C 'obtain':89C 'permit':112C 'read':114C 'remot':85C 'request':109C 'sensit':90C 'user':110C","first_public_at":"2026-11-07T05:18:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17405","severity":null,"published_at":"2026-11-07T05:18:57+00:00","modified_at":"2026-11-07T05:18:57+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","fetched_at":"2026-11-07T05:46:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17405:2005","url":"https://www.ibm.com/support/pages/node/7295637","severity":null,"published_at":"2026-11-07T06:05:36+00:00","modified_at":"2026-11-07T06:05:36+00:00","first_seen_at":"2026-11-07T06:05:36+00:00","fetched_at":"2026-11-07T06:05:36+00:00","note":"IBM bulletin node/7295637 lists CVE-2026-17405 (CVSS 8.8) fixed in 10.0.8.13. 12.1.1.3 fix comes from the CVE record via OpenCVE; the 12.1.1.3 bulletin text I got was truncated before this CVE, so that part is unconfirmed. No interim fix or exploitation seen.","cites":["https://www.ibm.com/support/pages/node/7295637","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}